microsoft/avml

Health v2 · maintenance only

Adoption not part of the score

1126 stars · 96 forks observed · 2026-10-22

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

AVML is a portable X86_64 userland volatile memory acquisition tool for Linux, written in Rust and distributed as a static binary. It captures memory images without prior knowledge of the target distribution or kernel, and can upload them to Azure Blob Storage or via HTTP PUT.

Use cases

• acquire volatile memory from a linux host for forensic analysis
• capture a memory dump without compiling kernel modules on the target
• upload memory images to azure blob storage during incident response
• convert between LiME, AVML, and raw memory image formats
• stream a memory snapshot directly to remote storage
• collect compressed memory images to minimize transfer size

When to choose

• you need a static, dependency-free memory acquisition binary for diverse Linux distributions
• you want to upload memory captures to cloud storage like Azure Blob Store
• you need LiME-compatible output without on-target compilation or kernel fingerprinting

When to avoid

• the target kernel has kernel_lockdown enabled
• you need memory acquisition on non-x86_64 architectures
• you need a GUI-based forensic suite rather than a CLI acquisition tool

Facets

cli-tool · maturity active

security cli security operating-systems cli memory-forensics memory-acquisition incident-response dfir rust azure-blob-storage lime-format forensics linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="microsoft/avml")